fix: run privileged commands on the exec channel, never typed into the shell #25

Merged

christianmanivong merged 2 commits from fix/sudo-not-in-command-1039 into master 2026-10-12 21:00:59 +00:00

Conversation 0 Commits 2 Files Changed 6

+740 -72

2 Commits

Author	SHA1	Message	Date
Christian Manivong	108f6fb3ca	fix: stage root writes in a mktemp file, never at a fixed /tmp path ... Now that a whole _sudo line runs as root, `mv /tmp/netork_snmpd.conf /etc/snmp/snmpd.conf && chown root:root … && chmod 644 …` would have let a local user plant a symlink at the fixed /tmp path and have root's chown and chmod follow it (e.g. to /etc/shadow). The same held for 00proxy. _install_file_as_root stages the content unprivileged in a fresh mktemp file (umask 077), checks the path it got back, and root installs it as a new regular file next to the target and renames it over: nothing root runs follows a symlink or changes the owner or mode of an existing path. Nothing runs as root when staging failed. get_vpn_tunnels always reads `wg show all dump` from the exec channel; the predictable /tmp/.netork_wg_<hash> file holding the private keys is gone.	2026-10-12 22:56:06 +02:00
Christian Manivong	cf8ee38a90	fix: run privileged commands on the exec channel, never typed into the shell ... _sudo typed `echo '<password>' | sudo -S -p "" <command>` into netmiko's interactive shell. bash kept it in its history, so every poll wrote the sudo password into the login user's ~/.bash_history, and while the command ran it was in the process list for every local user (NetOrk/netork#1039). _sudo, _sudo_status and _run_privileged with a password now run on an exec channel like run_command(privileged=True): the password reaches sudo -S on stdin, there is no PTY to echo it, and the script starts with `exec </dev/null` so a non-prompting sudo leaves it unread. The whole command runs as root in one sh -c - before, only the part up to the first `;`, `&&` or `|` did. The exit status comes from the channel. The interactive session switches its history off before its first command. get_vpn_tunnels with a password reads `wg show all dump` from the exec channel instead of a temp file that held the private keys.	2026-10-12 22:51:07 +02:00